6 ms·
As a user I strongly agree that I want to know which of my username or password is wrong. While you're at it, please remind me which characters your website all
by crasshopper 12y ago
As a user I strongly agree that I want to know which of my username or password is wrong. While you're at it, please remind me which characters your website allows, and how many are expected.
User/pass guessing by crackers can be solved with passphrases. Don't let registrants get by with a crackable password. Then remind us at the login screen that your site wants a passphrase (you can even flash me something that reminds me of the registration prompt if I forget my passphrase).
- smsm42 12y agoThis comes dangerously close to this one: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/ https://www.portcullis-security.com/security-research-and-do... Very user-friendly, but not exactly secure. Each bit of information you volunteer to unauthorized user reduces the work the attacker has to do to gain access. As for "how many expected" - limiting the password length is not exactly a good idea in any case.
- crasshopper 12y agoI just mean if you do limit the password length or character type, please remind me at the login screen, because there's no way I will remember across sites who wanted 6-8 characters from [aA9$_!#] and who wanted 12-16 from [a9-].
- smsm42 12y agoI'd rather just use password manager. Site saying "I have passwords of up to 8 chars" just makes me feel uneasy. Also creates a bigger barrier for fixing it to do the thing right.